CVE-2026-44406
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability. Since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enables local arbitrary code execution, privilege escalation, and memory corruption.
Risk Assessment
A local attacker can execute arbitrary code with SYSTEM privileges, leading to full compromise of the workstation. This may result in privilege escalation and memory corruption.
Recommendation
Apply the ZTE vendor fix for the uSmartView client and restrict the ability to place DLL files in directories used by the service.
Other vulnerabilities in ZTE uSmartView
See all- CVE-2026-44407Medium
A remote denial-of-service vulnerability exists in the ZTE Cloud PC client uSmartview, which may lead to memory corruption and remote denial of service. The description does not provide technical details or affected versions.
- CVE-2026-40004Medium
There is an openssl.cnf privilege escalation vulnerability in the ZTE Cloud PC client uSmartview. An attacker can execute arbitrary code locally and escalate privileges.
Original NVD description (English source)
ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enables local arbitrary code execution, privilege escalation, and memory corruption.contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enables local arbitrary code execution, privilege escalation, and memory corruption.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS